tedwill wrote:
If it's not enabled, why can't the files be removed?
As others have said, it is part of the operating system, which resides on a read-only, cryptographically sealed volume. The only way Apache is getting updated is with a software update from Apple.
I was able to get an exception to using Macs in my company. Many of our developers are using them now, and the Apache files are raising red flags with our auditors.
It sounds like you, or your auditors have some difficult decisions to make. Apple makes consumer devices. Lots of enterprise people use Apple devices anyway. But it is important to remember that enterprise users aren't Apple's target audience. Apple fundamentally doesn't care about your auditors.
Aside from waiting for the next security update from Apple, can I just install (upgrade) the latest version of Apache, which does contain the fixes -version 2.4.54 (the current macOS build for Apache is 2.4.53)?
As others have said, not really. You can install a newer version of Apache in addition to the system version. But you can't remove the system version.
Furthermore, all of this will be repeated with the next set of security patches from Apache, or zsh, or libxml, or any of a few hundred other open-source packages. If you want to use Macs, you really should develop a better understanding of the security context of the Apple market. Your auditors have no clue. There are steps you can take to improve your security while still using any of those built-in, but disabled developer tools. But to do that, you need a better understanding of what's going on, both on the Mac and in the media. Otherwise, you stand a real risk of satisfying the auditors only to make your Macs much more vulnerable to real-world exploits.
